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APOLLO EXPERIENCE REPORT 
GUIDANCE AND CONTROL SYSTEMS: 

COMMAND AND SERVICE MODULE STABILIZATION 
AND CONTROL SYSTEM 

By Orval P. Littleton 
Lyndon B. Johnson Space Center 

SUMMARY 

A description of the stabilization and control system for the Apollo command and 
service module is presented in this report. The main areas discussed are concepts, 
design, development, testing, and flight results. 

The stabilization and control system requirements initially consisted of three 
main areas: attitude reference, displays and controls (including automatic thrust- 
vector control), and reaction control. After extensive simulations, manual thrust- 
vector control was added. Also, the Block I system was designed to allow for 
performing onboard maintenance. However, because of humidity problems encountered 
during Project Mercury and the time required to isolate and correct representative 
problems, the onboard maintenance capability was deleted in favor of the Block II 
concept. In lieu of onboard maintenance, the Block II design featured hermetically 
sealed devices, potted cordwood construction, and redundancy in critical areas (for 
example, two gyroscope packages; two rotation hand controllers; two flight director 
attitude indicators; and redundant translation, abort, thrust on/off, and thrust-vector 
control paths). 

The stabilization and control system performed satisfactorily on the 4 unmanned 
and 11 manned flights of the Apollo Program. This performance can be attributed to 
conservative design techniques; to the use of state-of-the-art components; to extensive 
developmental, qualification, and acceptance testing; to extensive vehicle checkout at 
prime-contractor facilities and at the NASA John F. Kennedy Space Center; and to 
various simulation programs at the NASA Lyndon B. Johnson Space Center (formerly 
the Manned Spacecraft Center) and at contractor facilities. Recommendations for 
future programs are given. 



INTRODUCTION 


Initially, the command and service module (CSM) stabilization and control system 
(SCS) was to provide the capability for controlling spacecraft rotation and translation, 
an attitude reference system (ARS), and the displays necessary to allow the astronauts 
to monitor automatic operation as well as to exercise optimum control of the spacecraft 
during manual maneuvers. A primary design requirement was that no single failure 
would result in the loss of the spacecraft or the flight crew. Because of the predicted 
high accelerations from the service propulsion system (SPS) engine, manual thrust- 
vector control (MTVC) was not considered feasible and thus was not required. Exten- 
sive simulations subsequently showed that MTVC could be used effectively by the 
astronauts, however, and MTVC became the primary backup mode used in the event 
of a failure in the primary guidance, navigation, and control system (PGNCS). 

From early in the program (November 1961) until the major redesign in 
June 1964, the SCS was the primary method of flight control; that is, the SCS was in 
series with the guidance and navigation (G&N) system (fig. 1). As the primary method 
of flight control, the system had to be highly reliable to meet the mission requirements. 
Despite the efforts of reliability and design engineers, the equipment mean time be- 
tween failure was of the same order of magnitude as the mission time. Hence, the 
most feasible solution to the problem was to provide standby redundancy in the form 
of onboard spares. 



Figure 1.- Diagram of the Block I guidance and navigation attitude control mode. 
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The SCS was initially planned with complete standby redundancy in the form of 
plug-in modules or subassembly spares, or both. With the aid of simple checkout 
equipment, the crewmen would be able to detect malfunctions at the module or sub- 
assembly level and to make the necessary replacements. The mean time to repair 
(estimated to be 30 minutes) was not believed to be significant during the midcourse 
trajectory because attitude-disturbing torques would be small and trajectory corrections 
could be made after the system was restored to normal operation. 

In 1963, problems involving humidity, connectors, single-point failures, and 
relays led to a new design, called Block II. The details of these problems are dis- 
cussed later. Definition of the Block II concept resulted in elimination of in-flight 
maintenance; adoption of hermetic sealing of devices for humidity purposes; use of 
state-of-the-art connectors; and addition of redundant control paths and, eventually, 
of special screening tests to improve the reliability of the relays. It was also 
specified that backup steering would be provided by the SCS in the differential-velocity 
(AV) modes during the transearth injection phase and during the translunar and trans- 
earth midcourse velocity corrections. 

As a backup to the PGNCS, the Block n SCS provides stabilization and control of 
the spacecraft for rotation, translation, and SPS thrusting (using the CSM reaction 
control system (RCS) engines and the SPS engine). The Block II SCS also provides the 
required displays and controls to permit the necessary crew interface with the con- 
trolling elements. There are additional interfaces with the PGNCS (fig. 2). 

The Block II definition phase covered the period from June 4 to August 18, 1964. 
This phase was a period of cooperative effort between the prime contractors and NASA 
to determine the feasibility of the Block II approach, to establish requirements in the 
interface areas, and to detail the mechanization. The evolution of the SCS design is 
shown in the time line in figure 3. A discussion of the final design follows. 
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Figure 3. - Evolution of the stabilization and control system. 


DISCUSSION 


Attitude Control System 

The attitude control system (ACS) provides backup attitude flight control capa- 
bility for the spacecraft during all mission phases and also provides for thrusting of 
the SPS engine. The ACS can be operated in either the automatic or the manual mode. 
Propulsive force is provided by 16 hypergolic -propellant, nonthrottleable engines 
(nominally 445-newton (100 pound) thrust), and low limit-cycle rates are maintained 
by pseudorate feedback. 

The ACS is contained within the SCS and is composed of the electronics necessary 
to accept command signals from the rotation and translation hand controls, rate and 
attitude-error signals from the ARS, and configuration switching signals from the 
main control panel. The ACS causes the CSM RCS jets to fire in such a manner as to 
control vehicle motion. 

The ACS provides the following backup functions in case of a primary control 
system failure, or in those instances when a shutdown of the primary system is desired. 

1. Holds the spacecraft attitude within a selectable dead band, using error 
signals from the ARS 

2. Provides for manual control of spacecraft attitude in the following four 
configurations: proportional rate commands, on/off acceleration commands to the 
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RCS solenoid automatic coils, minimum-impulse commands from the rotation hand 
controller (RHC) to the RCS solenoid automatic coils, and on/off acceleration commands 
from the RHC direct switches to the RCS solenoid direct coils 

3. Provides for manual translation commands in six directions with the trans- 
lation hand controller (THC) 

4. Provides for automatic rate stabilization of the vehicle 

5. Provides for manual ullage commands to either the automatic or the direct 
RCS solenoid coils 

6. Provides override logic for compatibility between automatic and manual 
operation (Astronaut direct commands take precedence and cause the appropriate 
automatic functions to be inhibited. ) 

A simplified functional block diagram of the single-axis ACS is given in figure 4. 
The ACS thruster arrangement is shown in figure 5. 



Figure 4. - Functional schematic of the attitude control system. 
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Figure 5.- Thruster arrangement of the attitude control system. 


Attitude Reference System 

The purpose of the Block II ARS is to provide a backup attitude reference 
capability for the Apollo spacecraft control functions. The primary attitude reference 
is provided by the PGNCS. The ARS consists of two sets of three body-mounted 
attitude gyroscopes, either set of which can be used in the rate mode, and a coupler 
unit that generates Euler angles. The principal problem with the ARS was the drift 
rate; the problem was solved by improved design and increased knowledge of this 
equipment. 

In providing a backup attitude reference capability for spacecraft flight control 
operations, the following functions are performed by the ARS. 

1. Provides vehicle attitude errors (in body coordinates) to the vehicle backup 
control system during the coast and thrusting phases 

2. Provides vehicle attitude errors (in body coordinates) for display on attitude- 
error needles 

3. Provides a set of Euler angles, which describes the orientation of the vehicle 
reference frame with respect to some inertial reference frame, for display on a three- 
axis attitude ball 

4. Provides total roll angle (about the command module (CM) stability axis) for 
display during entry 
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5. Provides resolution of small Euler angular errors (treated as vector quan- 
tities) into body-axis errors for display on attitude-error needles (These angular 
errors are the difference between a set of Euler angles that describes the desired 
vehicle orientation and a set that describes the actual vehicle orientation.) 


Controls and Displays System 

The controls and displays system (figs. 6 and 7) provides the hand controllers, 
the flight instruments, and the dial settings necessary for the astronaut to monitor 
and control the spacecraft during the various flight modes. The principal developmental 
problem associated with the controls and displays was fraying and fracturing of the 
cabling for the hand controllers. The design trade-offs among durability, flexibility, 
and flammability were so difficult that advancement in the design of flexible cabling 
was the final solution. 



Figure 6. - Block diagram of the controls system. 
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Figure 7. - Block diagram of the displays system. 

System description . - The control functions and the display functions of the 
controls and displays system are described in the following paragraphs. 

Control functions : The control functions of the Apollo SCS are provided by the 
translation controller (fig. 8), the rotation controller (fig. 9), and the attitude- set 
control panel (ASCP) (fig. 10). 

The translation controller (1) provides manual acceleration control of the space- 
craft (CSM combination only) rectilinear motion in both directions along the three 
principal axes, (2) initiates a CSM/Saturn IVB (S-IVB) abort command to the space- 
craft mission sequencer by counterclockwise rotation of the controller handle, 

(3) transfers spacecraft thrust-vector control (TVC) from the PGNCS to the SCS by 
clockwise rotation of the controller handle, and (4) is capable of simultaneous multi- 
axis actuation. 
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Figure 8.- Translation controller. Figure 9.- Rotation controller. 



Figure 10. - Attitude-set control panel. 


The rotation controller (1) provides 
three-axis manual proportional body -rate 
commands or direct angular acceleration (by 
switch selection) for spacecraft rotational 
motion in both directions about the three prin- 
cipal axes from breakout switch actuation 
(1. 5° travel from neutral) to the soft stops (10°), 

(2) provides emergency angular acceleration 
commands directly to the RCS jet solenoids by 
controller emergency direct switches (11°), 

(3) provides manual proportional SPS- 
engine gimbal-position control in pitch and 
yaw during MTVC, and (4) is capable of 
simultaneous multiaxis actuation. 

The ASCP provides selectable, three- 
axis, spacecraft inertial-pointing signals 
by means of thumbwheel controls and dial 
readouts. These signals are summed with 
either the PGNCS inertial measurement 
unit (IMU) or the SCS gyroscope display 
coupler (GDC) inertial-attitude signals to 
produce total-attitude-error signals that 
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are displayed on the flight director attitude indicator (FDAI) attitude- error needles to 
allow precise manual rotation maneuvers to the selected inertial angles. 

Display functions : The display functions of the Apollo SCS are provided by the 
FDAI (fig. 11) and the gimbal-position and fuel-pressure indicator (GP/FPI) (fie- 
The FDAI performs the following functions. g ‘ 



Figure 11.- Flight director attitude 
indicator. 



Figure 12.- Gimbal-position and 
fuel-pressure indicator. 


1. Provides an inside-out display of 
the spacecraft attitude with respect to a 
selected inertial frame of reference by 
means of a graduated three-axis ball and 
appropriate reference indexes 

2. Provides a "fly -to” display of the 
spacecraft angular position relative to an 
inertial reference in all three axes by 
means of attitude-error needles 

3. Provides a fly-to display of the 
spacecraft angular rate about each of the 
three mutually perpendicular spacecraft 
body axes before the 0. 05g level during 
entry (After 0.05g is reached, the dis- 
plays provide the angular rate about the 
spacecraft pitch axis and about the roll and 
yaw entry axes.) 

4. Provides a centralized display of 
attitudes, vehicle rates, and attitude errors 

5. Provides coarse attitude orienta- 
tion (obtainable with the ball) and fine 
orientation using attitude-error needles 

6. Indicates the IMU maneuver limits 
and the approach of these limits during 
maneuvers 

7. Provides a monitor and a cross- 
check of reference-equipment conditions 
by comparing body-axis rates adjacent to 
body -axis attitude errors 

8. Provides a monitor of the SCS 
execution of reference-system commands 
in three axes by three command needles 

9. Provides variable scale factors in 
rate and error indications for varying pre- 
cision of the maneuvers required during the 
different mission phases 
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The GP/FPI (1) displays the Saturn II fuel and oxidizer pressures on one of the 
sets of redundant meter movements during boost, (2) displays the S-IVB fuel and 
oxidizer pressures on the other set of redundant meter movements during boost, 

(3) displays the angular position of the service module (SM) main propulsion engine 
gimbal about the pitch and yaw axes, one on each of the dual sets of meter movements, 
and (4) provides for manually inserting initial-condition command signals into the actu- 
ator servosystems for both pitch and yaw by means of thumbwheel controls. 

Problems. - Listed in the following paragraphs are the major problems that 
occurred during design and development of the Block II SCS controls and displays. 

Flight director attitude indicator: Problems were encountered in the design of 
the FDAI in the following areas. 

1. Spacecraft installation: During the development of the new Block II FDAI 
having an instrument panel backmounting feature, the need to support a thermal cold- 
plate from the rear face presented a major vibration susceptibility problem. Because 
the FDAI was cantilevered from the front face, the need arose to provide structural 
support at the rear face without interfering with the coldplate. The design solution 
required redesign of the coldplate to incorporate through holes, modification of the 
FDAI backplate to receive supporting pins, and addition of supporting pins to the 
secondary structure. The obvious effect of this design was the loss of ready access 
to both the FDAI and the coldplate for maintenance. 

2. Needle vibration: Because of the thinness, the length, and the cantilevered 

support of the attitude- error needles, redesign was required as a result of vibration 
testing. These needles were made more rugged to withstand the vibration environment. 

3. Electroluminescent (EL) lighting: When the Block II control and display re- 
design was instituted, the contractor implemented the use of integral EL lighting. 

The SCS subcontractor experienced difficulties in orienting commercial vendors to 
aerospace requirements. In addition, problems were encountered with the consistency 
of EL lamp characteristics, with the reflections and aberrations from nearby surfaces, 
and with the uniformity of light intensity and color. These problems ultimately were 
resolved, but the contractor was forced to change the EL power and power factor 
requirements. It was found that better lamp operation was obtained when the supply 
voltage was higher than the nominal spacecraft voltage. 

4. Lighting control: A Variac transformer is part of the spacecraft wiring so 
that display lighting intensity can be varied. The current surge resulting from on/off 
operation of the lighting control loads the alternating-current inverter and, thereby, 
causes line voltage variations. These voltage variations cause rate-sensor oscillations, 
which result in inadvertent reaction jet firings. To minimize this effect, a resistor 
was placed across the Variac transformer, and the spacecraft operational procedures 
were changed so that the display lights were dimmed but not turned off. 

Attitude-set control panel: During vibration testing, the ASCP attitude-set 
thumbwheels tended to drift slowly. To eliminate this problem, friction-type disks 
were incorporated into the thumbwheel support mechanism. 
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Hand controllers: The following problems were encountered with the hand 
controllers. 

1. Cabling: Major problems occurred with the cables from both the RHC and 
the THC. Because of their exposed positions in the CM cabin, the cables were sub- 
jected to excessive wear and tear during checkout. Constant movement and stowage 
flexed the cables until cracks appeared. Removal of the outer cable covering exposed 

a Teflon braid that had no abrasion or puncture resistance. When applied to the cables, 
other nonflammable materials either cracked when flexed or were not sufficiently 
flexible. Strain relief of the cables at the point of exit from the enclosures was a 
major problem because the excessive strains actually encountered were not originally 
envisioned and, consequently, were not specified in the initial design requirements. 

The subsequent trade-off among material flammability, durability, and flexibility 
characteristics proved to be extremely difficult. The use of a special covering and the 
restriction of hand- controller use during the ground test phase solved the problem. 

An alternate hand controller also was used during this time. 

2. Handle shape and force characteristics: The handle shape and the force/ 
deflection characteristics are subjective requirements and were defined only after a long 
and tedious evolutionary process. The design was changed continually during the middle 
period of the program, even after hardware commitments had been made. A belated 
solution was the generation by the NASA Lyndon B. Johnson Space Center (JSC) (formerly 
the Manned Spacecraft Center (MSC)) of the specifications in this particular area. 


Thrust-Vector Control System 

The TVC system provides flight control of the Apollo spacecraft during thrusting 
of the SM SPS. The system provides for both automatic and manual control about all 
three body axes when the CSM and the lunar module (LM) are docked (CSM/LM con- 
figuration) and when the CSM and LM are undocked (CSM-only configuration). A 
detailed discussion of the TVC system, the design requirements, the problems, and 
the changes made throughout the Apollo SCS TVC development is presented in the 
following paragraphs. 

System description . - The description of the TVC system includes control modes 
and functional requirements. 

Control modes: The Apollo spacecraft has several modes for controlling powered 
flight. The modes can be divided into the two major categories of primary and back- 
up. The primary system uses the command module computer. The backup system is 
composed of analog components and includes automatic and manual control. Control 
modes for the TVC system are discussed in the following paragraphs. A functional 
diagram of the TVC system is shown in figure 13. 

1. Primary automatic mode: The Apollo Block H primary TVC system does 
not use the SCS electronics but uses an all-digital controller that sends commands 
directly to the SPS engine-gimbal servomechanism through a digital to analog converter. 
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2. Backup automatic mode: In the backup automatic mode (referred to as the 
SCS AV mode), the TVC system uses information from the SPS engine-gimbal servo- 
mechanism (position) and from the vehicle attitude and rate gyroscopes to generate and 
send control signals through the SCS TVC electronics to the SPS engine-gimbal servo- 
mechanism. The system does not operate on an attitude command signal but automat- 
ically holds the thrust vector fixed in inertial space. This procedure limits the use of 
the mode to real-time SPS-engine burns. 

3. Manual mode: The manual mode of operation (referred to as direct or rate 
MTVC) provides for commands from the pilot to the SPS engine-gimbal servomechanism 
by means of a proportional hand controller. 

4. Roll axis control: For each of the operational modes just described, the pitch 
and yaw axes are controlled by the angular motion of the SPS engine. The roll axis, 
however, is controlled by firing the SM RCS jets. The roll control may be completely 
automatic, completely manual, or a combination of both. 



i i 

(Block 1 only) 


Figure 13.- Functional schematic of the thrust-vector control system. 
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Functional requirements of the SCS TVC: To fulfill functional requirements, the 
SCS TVC must provide pointing and stabilization during the thrusting maneuvers, which 
include midcourse corrections, lunar-orbit insertion, transearth injection, Earth- 
orbital retrofire, and high-altitude aborts. The SCS TVC also must provide for stable 
operation of the SPS engine-gimbal servomechanism. 

Problems . - In developing a TVC system of the magnitude required for the 
Apollo Program, many problems were encountered. Some problems were not signif- 
icant enough to record; only the more significant problems and the manner in which 
they were resolved are detailed here. 

The SPS actuator development : Problems in design of the SPS electromechanical 
actuator were primarily caused by difficulties in the development of the electromagnetic 
clutch. The principal problems with the clutch were overheating and nonlinearity. 

The nonlinear effects, although affecting the vehicle limit cycle and making one actuator 
appear slightly different from another, did not interfere substantially with the system 
operation. The primary cause of clutch overheating was thrust misalinement during 
the SPS burns. The overheating caused a decrease in clutch gain, not only for that 
burn but also for subsequent burns. This gain decrease could have been as great as 
50 percent. However , a new actuator could have had a clutch gain of greater than 
50 percent of nominal. As a result, the control system had to be designed to allow for 
clutch-gain variations of + 50 percent. 

Three design changes were made to the actuator in an attempt to prevent clutch 
overheating. Overheating was eventually prevented by changing the gearing of the 
motor to the clutches. The slip speed between the rotating input and the stationary 
output members of the clutches was less, and the subsequent heat generation was less. 
The penalty for the design change was that, for a given motor speed, the SPS-engine 
bell moved more slowly. 

Large-signal stability: A direct result of lowering the SPS actuator rate capa- 
bility was a loss of some large initial -condition or nonlinear stability capabilities. 

When the Block II system was designed, the large-signal stability problem was resolved 
by a combination of imposing smaller limits on the SPS gimbal excursion and of lower- 
ing the autopilot gains. 

Pointing error: As a direct result of lowering the autopilot gains to eliminate 
the large-signal stability problems, the pointing error requirements were degraded; 
the degradation, however, was shown to be acceptable for Apollo missions. 

Body-bending data variation: The variation in body-bending data was a major 
problem. The original design was based on the first set of data (1963). In April 1965, 
NASA deleted modal testing for the CSM and for the CSM/LM. As a result, the auto- ’ 
pilot was changed to be less sensitive to body bending in September 1965. At that time, 
tolerances of + 15 percent for the bending frequency and ± 10 percent for the mode shape 
were assumed. 

In the spring of 1965, a subcontractor performed a modal analysis by which the 
structure was separated into the component parts rather than assumed to be a beam. 
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These data indicated a first-mode frequency 50 percent less than that of the 1963 data. 
This variation was considerably outside the 15-percent tolerance; however, the data 
were considered preliminary. 

In January 1966, on the first Block I flight spacecraft (spacecraft 009), a TVC 
system instability occurred during checkout on the launch pad at the NASA John F. 
Kennedy Space Center. Evaluation of the data indicated that the cause was probably 
a body-bending resonance at approximately 17 hertz. The bending analysis at that 
time indicated that in the free-free (flight) mode, the resonance would be in excess of 
30 hertz. Although the test was performed on the Saturn IB stack, it was believed 
that 17 hertz could be indicative of a free-free mode at the CM/SM interface. The 
Block I TVC system was modified and the instability corrected. However, considerable 
doubt was cast on the analytically generated bending data. The first two Block I 
vehicles did not exhibit any in-flight TVC instability, although components of signals 
at approximately 17 hertz were evident in the rate gyroscope traces of every Block I 
flight. Shortly thereafter, the modal analysis task was reassigned to another contractor. 

In the late summer of 1966, the prime contractor produced another set of 
bending data. The CSM/LM analysis indicated a first-mode frequency of 1. 12 hertz, 
which was in agreement with previously established data. At that time, notice was 
given that the Block n SCS was unstable and that modifications, if required, would 
have to be made promptly if existing hardware schedules were to be met. 

Shortly thereafter, a decision was made to redesign the SCS to provide adequate 
stability margins for all existing sets of bending data. The performance requirements 
were changed to the final value at that time. This relaxation was required because 
system performance was degraded when the system gains were reduced to the extent 
necessary to provide adequate stability for the range of bending data used. The SCS 
electronic components fabricated were designed to accommodate dominant modal 
frequencies in the range of 1.0 to 1.6 hertz. 

Revised (December 1966) subcontractor stiffness data for the LM were forwarded 
to the prime contractor from MSC. Using the revised data, frequencies were deter- 
mined for the CSM/LM half-full propellant-loading condition in April 1967. The first 
three frequencies were 2.15, 2.6, and 2.9 hertz. Also at that time, subcontractor data 
were available for the CSM/LM quarter-full propellant-loading condition. The first 
two bending modes were 2. 1 and 2. 4 hertz. In the summer of 1968, it was decided 
to modify several spare electronics boxes to a design based on bending in the 1. 75- to 
2.86-hertz range. Modal testing in late summer of 1968 indicated bending frequencies 
of 2. 76, 3. 02, and 3. 87 hertz. A decision to make the new design common to all 
spacecraft subsequent to spacecraft 103 (Apollo 8) resulted in fabrication of three 
separate autopilot configurations as flight articles before the first CSM/LM flight. 

The first CSM/LM flight spacecraft (Apollo 9) was used as the test article for an in- 
flight margin- stroking test. The results showed the first and second bending modes 
to be approximately 2.76 and 3.1 hertz, respectively. 

Propellant slosh: The SM and LM propellant- slosh dynamic stability was a 
concern because of the lack of baffles in any of the tanks to provide damping, the lack 
of definition of the slosh dynamics data, and the existence of dynamic changes in the 
slosh data because of the vehicle center -of -gravity motion. Although these concerns 
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were not resolved completely, they were resolved to the extent that the total vehicle 
stability was not a problem during a given SPS- engine burn. 

Bending-compensation technique for the CSM/LM configuration: As previously 
mentioned, the unavailability of good bending data resulted in the implementation of 
three different CSM/LM bending-compensation designs. Although lack of data was the 
primary cause, the technique used for the compensation design was partly responsible 
for the three complete redesigns. Frequency band filtering was used in conjunction 
with the notch filter technique. The notch filter was sensitive to both increases and 
decreases in .the bending frequencies, whereas the rolloff-type filter was sensitive 
primarily to decreases. The rolloff filter can be designed such that frequency 
decreases can be handled by phase stabilization (and increases, usually, by gain 
stabilization), whereas the notch filter is limited to an "either/or" compensation 
technique. In retrospect, it is evident that rolloff filtering of the bending dynamics 
could have prevented some of the cost of the final design. 


DEVELOPMENT 


Several problems occurred during the development of the Block I system. The 
following paragraphs include details of those problems. 


I n-Flight Maintenance 

In-flight maintenance was deleted for two reasons. First, although it was 
technically feasible for the astronaut to detect and replace a defective module or 
subassembly, it was not an easy task. Modifications made to fulfill the increased 
humidity requirement made the job even more difficult. In addition, under control 
system laboratory conditions, a trained technician often required many hours to locate 
and replace a defective component. Second, the Block n concept made the SCS a 
backup to the PGNCS and called for (1) complete repackaging techniques for humidity 
purposes and (2) the addition of redundant control circuits in critical areas; both of 
these factors, it was believed, eliminated the need for in-flight maintenance. 


Humidity 

In 1963, electrical failures occurred on the Mercury-Atlas 9 flight. The failures 
were traced to short circuits caused by condensation resulting from an unexpectedly 
severe environment of 40- to 70-percent relative humidity at a temperature of 297 + 3 K 
(75° ± 5° F). On Apollo spacecraft, humidity and temperature are maintained by the 
environmental control system (ECS). 

The ECS control is effectively limited to the cabin interior; that is, in front of 
the equipment panels. The atmosphere behind the panels, in corners, or in protected 
pockets is beyond direct control by the ECS. Moisture is removed through the suit 
circuit or with a vacuum cleaner. If the temperature falls below the dewpoint (approx- 
imately 289 K (60° F)), condensation will occur. Analysis indicated that condensed 
moisture could be expected in and around the equipment located in the pressurized 
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section of the CM even with the ECS operating properly. Based on these factors, a 
requirement was established that spacecraft equipment withstand 100-percent relative 
humidity during flight operation. Subsequently, the Block I SCS was modified to fulfill 
this new requirement. 

The nature of the Block I changes consisted of backpotting and adding rubber seals 
to the electrical connectors. The system later passed qualification testing and was 
flown successfully on spacecraft 009, Oil, 017, and 020. The change in the humidity 
requirement was a major factor in the Block II design concept. 


Block I Connectors 

The Block I SCS equipment boxes were interconnected electrically through small 
multipin connectors. The female half was attached to the spacecraft, and the male half was 
on the equipment enclosure. Mating difficulty was encountered because of the mass and 
length of the equipment enclosure and because of the high pin density of the connector. To 
mate the connector without breaking or bending pins was extremely difficult. Other prob- 
lems included connector body breakage during insertion and removal of the enclosure, con- 
nector damage during crimping and pin removal, retention-spring breakage, and pin burrs. 

Because of the numerous problems experienced with the connectors, an alternate 
procurement source was considered. However, the part was of an advanced design; 
and, because of the considerable investment in the original vendor, alternate-source 
procurement was considered impractical. 

The high breakage and failure rate of the connector led to unexpectedly high 
usage of the available supply. This situation eventually resulted in prime-contractor 
schedule slippage because the supply was depleted and acceleration of resupply was not 
possible. The resupply problem was caused by the inability of the spring retention clip 
manufacturer to meet the resupply delivery needs. 

The connector problem for Block I was not solved by a design breakthrough or by 
the purchase of a different connector; instead, development was continuous until the 
end of the Block I program. The redesign and repackaging of the SCS brought about 
by the Block II decision included a change to standard connectors. No major problems 
were encountered in this area on the Block II system. 


Single-Point Failures 

The process of searching for and eliminating single-point failures has been long 
and tedious. Designers must continually search the wiring diagrams for trouble areas 
and document their findings in Failure Mode and Effect Analysis and Single Failure 
Point summaries. Examples of single-point failures found and corrected to date are 
as follows. 

1. SCS logic bus: A single short circuit to ground would disconnect power to all 
guidance and control mode and function switches. 
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2. TVC servoamplifier power switch: A failure in the single switch used for 
both servoamplifier s would disable TVC completely. 

3. Entry roll display: A single power bus failure would disable all three methods 
of roll display. 

4. SCS drivers: A single SCS failure would cause the primary mode to disable 
the reaction jet drivers. 

5. Rotation control for MTVC: A single power failure would leave the rotation 
control inoperative during MTVC operation. 

The identification of single-point failures is difficult and time consuming. A 
given system generally consists of two modes, the nominal mode and the backup or 
redundant mode. The nominal and redundant modes are similar, but the system is at 
least twice as complex as it would be without the redundant mode. A failure, of 
course, can occur in either mode. The failure conditions and ensuing states usually 
are known and understood by the designers. Special failure tests are performed to 
ensure that a single failure (and sometimes a multiple failure) does not disable a 
redundant system. Although this level of failure analysis is tedious, it is usually 
successful. 

The level of difficulty for single-point failure analysis increases substantially 
when several systems must be combined to form a total, integrated system. The 
permutations of the problem elements and the types of failures increase considerably. 
Consideration must be given to power failures, switch failures, and primary- mode 
failures. Although these total-system effects should be analyzed at the time of system 
specification so that each system can be designed in terms of the whole, this procedure 
is seldom followed because of time and schedule constraints and because of a lack of 
detailed understanding of the total concept. As a result, many hours are spent over 
drawings checking for the required redundancy after the hardware has been committed 
for manufacture. 

At this point in the failure analysis, modifications of ground rules introduce 
problems. For example, an original ground rule was that switches would not short 
circuit to ground. Experience with the switches later in the program caused this 
ground rule to be deleted. As a result, a whole new class of failure possibilities was 
introduced. 

The complexity of modern space-flight systems and the stress on high reliability 
place a premium on fail-safe design and on minimization of single-point failures. 
Unfortunately, the current state of the design process does not appear capable of 
handling these requirements. Thus, the development of a method by which a system 
may be analyzed for possible failure modes quickly and thoroughly is highly desirable. 
Furthermore, the designers themselves should be made more fully conscious of 
failure modes and of the importance of system reliability. 
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Relay Failures 


The relay selected by the SCS subcontractor for use in the Apollo SCS early in 
the Block I program was used throughout Block I and, subsequently, throughout 
Block II. This relay was chosen on the basis of its performance capability, its per- 
formance history, and its size and weight and on the basis of the quality assurance 
and reliability procedures and practices of the vendor. Few relay problems were 
initially encountered during the Block I program. Each problem or relay failure (six 
in all) was analyzed or resolved on its individual merits, and no pattern of failure 
modes evolved. One of the six Block I relay failures was caused by an internal solder- 
ball. Extensive research and testing were performed to ensure that this was not a 
serious problem in the existing Block I SCS. At that time, a change from a soldered 
case-to-header assembly to an electron-beam-welded assembly was made, and no 
further solderball problems occurred. 

The welded-header relay was used exclusively in the Block n SCS. There were 
88 such double-pole, double-throw relays used in this system. The subcontractor 
procured 4091 relays for the total Apollo Program in two separate 2-week periods 
(four lots) during January and July of 1966. Another 451 relays were retained by the 
vendor for group B and C lot acceptance test purposes. From this overall total (4542), 
there were 27 failures. A limited number of Block O SCS relay malfunctions were 
encountered during module testing before November 1966. The number and type of 
malfunctions were not unusual or repetitive, and the analysis and establishment of 
appropriate corrective action were performed with normal concern. However, in mid- 
November 1966, two relay failures occurred during black-box-level testing, including 
one in a qualification test. These failures triggered an extensive investigation by the 
subcontractor. The effect of the failures at that time was a major concern in the 
Apollo Program because many of the electronic systems contained these relays. Hence, 
the SCS subcontractor investigation was monitored very closely by both the prime 
contractor and NASA. 

The two major distinctions made relative to the failures were the types of 
failures and the test level at which they occurred. These characteristics are summa- 
rized in table I. The relay investigation led to the following specific conclusions. 

1. Although the relay-failure-rate predictions based on existing experience had 
not met the originally estimated failure-rate predictions, the SCS would meet the system 
reliability requirements. 

2. Design of the SCS was such that no single relay failure would prevent mission 
success. 

3. The relay represented the best proven state-of-the-art design and was fully 
acceptable for use in the Apollo Program. 

4. Subcontractor in-house module and relay testing effectively screened out 
normally open, low-contact-force relays and low-insulation-resistance (wet) relays. 

5. There appeared to be no change in the test criteria (at the device, module, or 
relay level) from the existing process that would reduce the probability of relay hangup. 
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TABLE I. - RELAY FAILURES 
(a) Block I and Block II failures 


Relay failures 

Number 

Block I 

In the field 

0 

At the module level 

3 

During device predelivery acceptance testing 

1 

During device qualification testing 

2 

Subtotal 

6 

Block II 

During parts testing 

2 

At the module level 

14 

During device predelivery production check 

1 

During device predelivery acceptance testing 

1 

During device qualification testing 

2 

During device postdelivery retrofit cycle 

1 

Subtotal 

21 

Total number of failures in 4542 relays 

27 


(b) Relay failure summary 


Relay failure mode 

Assembly 

Number of failures 

level 

Block I 

Block II 

Total 

Contamination 

Module 

1 

5 

6 


Device 

0 

2 

2 

Normally open contacts 

Module 

2 

8 

10 

failed to close 





Normally closed contacts 

Device 

2 

2 

4 

failed to open 





Part 

0 

2 

2 

Normally closed contacts 

Device 

0 

1 

1 

failed to make contact 





Broken internal coil wire 

Module 

0 

1 

1 

Poor solder connection 

Device 

1 

0 

1 





Design Features 

The general hardware design features of the Block II SCS for the Apollo spacecraft 
are characterized as follows. 

1. The physical system comprises 14 contract end-items (fig. 14 and table II): 
one reaction jet engine on/off control (RJEC); one electronics control assembly (ECA); 
one electronics display assembly (EDA); one GDC; one thrust-vector servoamplifier 

(TVSA); two gyroscope assemblies (GA-1 and GA-2); two FDAI units; one GP/FPI; one 

ASCP; * one THC; * and two RHC units. * 

2. These components are hermetically sealed, conduction-cooled, individually 
mounted structures; except for the gyroscope assemblies, no vibration isolation is 
provided. 

3. The packaging of hardware components into individual assemblies is arranged 
for a logical functional grouping of system elements and for ease of system malfunction 
isolation and troubleshooting. 

4. The electronic assemblies are electron-beam-welded aluminum structures 
that house stacked, cordwood-type modules containing high-reliability electronic 
piece parts. The parts are interconnected by welded sections of bus wires that also 
connect to module exit headers. The modules are interconnected by welded exit 
connections to bus wires sandwiched between thin Mylar-film matrix sheets. The 
matrices are connected to the external connectors by lead wires. 

5. Approximately 15 percent of the total system electronics consists of inte- 
grated circuit flatpacks that significantly reduce system weight, volume, and power 
requirements. 

6. The .splay panels and indicators are electron-beam-welded aluminum 
structures, lne indicator enclosures house servometric-type meter movements and 
high-reliability electronic piece parts and incorporate EL dial face lighting. The 
control panel houses high-reliability electronic resolvers. 

7. The hand controllers are aluminum structures incorporating a tapered-wedge- 
type lock/stow mounting feature. The controller-handgrip form factors and force and 
travel provisions are human-factored for optimum control performance in the space- 
flight environment. 

8. System functions that are critical to crew safety are ensured by the addition 
of switchable redundant circuitry. 


1 


No coldplate cooling. 
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TABLE n. - HARDWARE PHYSICAL CHARACTERISTICS 


Block II 
CEi a 

■ - ’ ' H 

Quantity 

per 

system 

Weight 

Volume 

Block I CEI 
equivalent 
(b) 

Reason for difference 

kg 

lb 

3 

cm 

. 3 
in 

ECA 

1 

7.5 

16.5 

9 293 

567 

Pitch ECA (1) 
Yaw ECA (1) 
Roll ECA (1) 

Power saving and reliability 
considerations of Block II 
concept 

TVSA 

1 

5. 7 

12.5 

7 048 

430 

RJEC 

1 

9.4 

20.7 

13 145 

802 

EDA 

1 

11.4 

25.0 

12 473 

761 

Display portion 
of DECA C (1) 

Added Block n display 
redundancy 

GDC 

1 

11.3 

24.9 

11 243 

686 

Auxiliary ECA 

a) 

Block II ARS mechanization 
differences 

GA 

2 

20.8 

45.8 

17 209 

1050 

AGAP d (1) 
portion of 
DECA, and 

RGP e (1) 

Reduced criticality of 
matched components 

RHC 

2 

8.6 

19.0 

4 589 

280 

RHC (2) 

Block II requirement of dis- 
crete control for each 
direction of rotation 

THC 

1 

2.7 

6.0 

1 836 

112 

THC (2) 

Block II requirement for 
redundant outputs 

FDAI 

2 

8.2 

18.2 

11 473 

700 

FDAI (1) 

No functional difference 

ASCP 

1 

1.5 

3.3 

1 147 

70 

AS/GPD f (1) 

Break up displays to provide 
greater flexibility of 
smaller packages 

Add fuel display and redun- 
dancy requirements 

GP/FPI 

1 

1.3 

2. 9 

1 180 

72 

Totals 

14 

88.4 

194.8 

90 636 

5530 

i 

(g) 

Not applicable 


Contract end-item. 

^Numbers in parentheses indicate quantity. 

Q 

Display electronics control assembly. 

^Attitude gyroscope accelerometer package. 

0 

Rate gyroscope package. 

^Attitude-set gimbal-position display. 

^Total quantity, 13; total weight, 108.4 kg (238.9 lb); total volume, 106 928 cm'* (6524 in'*). 
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TESTING 


The testing of the SCS was the culmination of the quality assurance program. 
The concepts, requirements, designs, and materials were merged during the testing 
into the final product that was demonstrated. The total testing effort was divided into 
four distinct categories: development, qualification, acceptance, and installation 
checkout tests. 


Development Testing 

The development tests were a series of functional, environmental, and engineering 
evaluation tests performed on materials, parts, and components to determine item 
suitability for incorporation into the SCS, to determine item performance characteristics, 
and to evaluate and improve designs. These tests included such activities as 
(1) determination of part, component, and subassembly characteristics: (2) selection 
of materials and parts by comparative tests; (3) evaluation in terms of critical envi- 
ronment, including anticipated or unknown amplification factors caused by the par- 
ticular application; (4) determination of performance stability or repeatability; 

(5) evaluation of changed or improved designs; (6) establishment of design margins: 
and (7) evaluation of parameter variation effects. 

The subcontractor was authorized ten complete engineering systems (five in both 
Block I and Block II configurations) to develop flyable configuration hardware. In 
Block I, the contractor attempted to enforce formal configuration control between the 
contractor and the subcontractor on these development systems. In retrospect, this 
practice was neither useful to the program nor helpful to the subcontractor; enforced 
configuration control was not even practical from a design standpoint. On Block n, 
configuration control was abandoned as a workable method for developing a system; 
instead, the more orderly approach of establishing a design baseline followed by for- 
mal design reviews was instituted. 


Qualification Testing 

The qualification tests consisted of a series of performance and environmental 
tests performed on production piece-part, end-item, and system hardware to demon- 
strate that the items met all applicable requirements of design and performance. 
Materials were qualified by the contractor and listed in an approved materials speci- 
fication, which the subcontractor used. When new materials were selected, the 
subcontractor tested these materials and submitted test results and samples of each 
material to the contractor for approval. Electronic piece parts were procured from 
vendors by means of rigidly controlled high- reliability parts specifications. Each 
specification contained a section that delineated the testing requirements for the parts. 
This section included the following sequential series of tests. 

1. Total sample (100 percent) processing tests: Visual inspection, high temper- 
ature, constant acceleration, temperature cycle, gross and fine leak tests, particle 
detection, burn-in, and X-ray 
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2. Group A acceptance tests: Group A 100-percent tests, visual inspection, 
mechanical inspection, and basic electrical parameters (Group A sample tests 
included high -temperature leakage, low-temperature gain, offset voltage, and dynamic 
resistance. ) 

3. Group B lot integrity tests: Visual inspection, mechanical inspection, 
solderability, temperature cycling, thermal shock, moisture resistance, shock, 
vibration, constant acceleration, terminal strength, salt atmosphere, high- temperature 
life, and 1000-hour operating life 

The qualification testing of completed end -items and of the system was divided 
into two major areas: design proof tests and system life tests. The design proof 
tests were performed in climatic and dynamic environments and were imposed on one 
unit of each operating end-item to specification limits. The system or mission life 
tests consisted of exposure of one complete complement of operating end-items (or a 
system) first to vibration and then to a salt/fog atmosphere. All these tests were 
preceded by a checkout test to establish baseline performance data, and the environ- 
ments then were sequenced to optimize use of time and facilities. Performance data 
were taken during and after the tests to demonstrate that the SCS met all applicable 
design and performance requirements and to verify that no serious design weaknesses 
existed that could cause inconsistent or marginal performance or a high probability 
of failure. 


Acceptance Testing 

Acceptance of completed SCS hardware by the contractor required that acceptance 
tests, at both end-item and system levels, be performed successfully before shipment. 
Successful performance was defined as a quality-control-witnessed test performed in 
accordance with a contractor -approved acceptance test procedure (ATP) wherein all test 
parameters measured fell within the specified tolerance limits. Parameters that were 
outside these tolerance limits could be submitted as a waiver request, which required 
contractor approval before shipment of the hardware. Each ATP specified the detailed 
steps to be followed by the test operator in performing the test, the configuration of the 
test articles, and any test equipment used to perform the test. Each ATP included the 
step-by-step settings to be made, the readings to be taken, the acceptable limits for 
each reading, and the instructions for recording data. The sheets on which these data 
were recorded became a part of the data package that accompanied each end-item and 
system throughout its service life. 


Vehicle Checkout 

As envisioned early in the Apollo Program, all hardware received from the 
subcontractor would undergo a receiving inspection test at the contractor facility. 

Before the receipt of the initial hardware, however, this concept was abandoned for one 
in which delivered hardware was to be installed directly into the spacecraft. The role 
of the contractor was to demonstrate, through tests, the continued functional and 
performance capability of the system when mated physically and electrically with actual 
spacecraft interfacing systems. The basic philosophy adopted for these tests was 


25 



two-pronged. First, proper system operation in the spacecraft structure and with 
spacecraft power applied through the spacecraft interconnecting wire harness was to 
be verified. All functions and modes were exercised to established performance 
requirements within allowable tolerance limits. Second, electrical and functional 
interface compatibility between the given system and the interfacing systems was to 
be demonstrated. These tests demonstrated compliance with the Apollo requirements 
for polarity, phasing, switching, scaling, and gain. 

The NASA-supplied automatic checkout equipment (ACE) was used for testing all 
spacecraft systems. This ACE hardware is capable of injecting stimuli and accepting 
signal-conditioned readouts simultaneously for a large number of systems. Use of 
ACE superseded the normal troubleshooting techniques of past programs in which each 
system had its allotted time on the vehicle and its own test console with the capability 
for injecting stimuli, accepting readouts, and monitoring numerous test points for 
probing suspected trouble areas. 


Service Life 

The original service life requirements for the SCS were specified as 1000 hours 
of ground checkout and 400 hours of flight. These values were based on the best 
estimates available at the time. The 400 hours of flight represent a typical 14-day 
lunar mission and proved to be a good estimate. However, the estimated 1000 hours 
of ground checkout time were insufficient. 

The subcontractor normally used between 300 and 400 hours before end-item 
delivery, considering that power was applied to lower level assemblies and to each 
subsequent higher level subassembly through end-item delivery. The contractor then 
performed system and combined-systems tests both at the manufacturing facility and 
at the launch facility. It became evident that the system had to be qualified to a higher 
than specified service life. Subsequently, one complete system was subjected to an 
additional 7700 hours of testing with no parameters falling outside the so-called 
"mission time extreme environment" values. Each device also was subjected to 
individual tests for comparison with the initial values. 


FLIGHT RESULTS 


Through 15 Apollo flights - 4 unmanned (spacecraft 009, Oil, 017, and 020) and 
11 manned (spacecraft 101, 103, 104, 106 to 110, and 112 to 114) - no major problems 
involving the SCS were encountered, and all SCS test objectives were achieved. In the 
following paragraphs, additional information on SCS performance and anomalies for 
each specific flight are presented. 

1. Apollo-Saturn 201 (spacecraft 009), Apollo-Saturn 202 (spacecraft Oil), 
Apollo 4 (spacecraft 017), and Apollo 6 (spacecraft 020): The SCS performed satis- 
factorily throughout these missions. 
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2. Apollo 7 (spacecraft 101): All detailed test objectives were accomplished 
satisfactorily. These objectives were SCS attitude control, SCS velocity control, 
manual takeover of TVC, and SCS drift checks. Two anomalies were reported during 
the Apollo 7 flight: one concerned the commander's RHC and the second concerned the 
EDA. The RHC failure (believed to be a sticky cam follower causing failure of a 
switch to open) occurred once during the flight. After the flight, the device was 
returned to the subcontractor facility, where it was subjected to room-temperature and 
high- and low-temperature vacuum tests with satisfactory results; that is, the flight 
failure could not be repeated. Design of the hand controller for spacecraft 103 and 
subsequent vehicles was different in this particular area (i.e., the sleeve bearings 
had been replaced with ball bearings), and no additional problems were experienced. 

In the EDA failure, FDAI-1 failed to transfer power to the SCS properly. System 
tests on the vehicle were performed by the prime contractor with satisfactory results. 
The device also passed a complete acceptance test performed by the subcontractor 
with no malfunctions. However, simulation of the failure (partial power transfer) on 
a subcontractor in-house system revealed that if a particular relay failed, the anomaly 
would occur. Although a relay malfunction could not be induced at either the device 
or module level, a solderball was found in the relay when it was opened for visual 
inspection. It was concluded that, under the zero-g condition in flight, the solderball 
could have caused the problem. 

3. Apollo 8 (spacecraft 103): The SCS performance was satisfactory throughout 
the flight. 

4. Apollo 9 (spacecraft 104): The SCS performance was satisfactory throughout 
the flight. The detailed test objectives of MTVC takeover from the PGNCS and the 
CSM autopilot stability margin-stroking test were accomplished satisfactorily. 

5. Apollo 10 (spacecraft 106): In general, the SCS performance was satisfactory 
throughout the flight; however, the crewmen stated that the FDAI indicated excessive 
drift in the pitch and yaw axes, although no actual measurements were recorded. 

After the flight, thorough testing of both gyroscope assemblies and of the GDC at both 
device and system levels did not verify the anomaly. A comparison of attitudes 
displayed by the SCS and the PGNCS after Earth-orbital insertion showed differences 

of less than 0.1° in all axes; these fractional differences indicated proper performance 
early in the mission. Because no attempt was made to measure the drift accurately, 
it was possible that the actual drift of the FDAI was not as great as it appeared. The 
anomaly was closed. 

6. Apollo 11 (spacecraft 107), Apollo 12 (spacecraft 108), Apollo 13 (space- 
craft 109), Apollo 14 (spacecraft 110), Apollo 15 (spacecraft 112), Apollo 16 (space- 
craft 113), and Apollo 17 (spacecraft 114): Performance of the SCS was satisfactory 
throughout these flights. 
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CONCLUDING REMARKS AND RECOMMENDATIONS 


With the exception of three minor anomalies, performance of the stabilization 
and control system was satisfactory on all Apollo flights, which included 4 unmanned 
and 11 manned vehicles. This success can be attributed to conservative design tech- 
niques; use of state-of-the-art components; extensive development, qualification, and 
acceptance testing; extensive vehicle checkout at the prime-contractor facilities and 
at the John F. Kennedy Space Center; and various simulation programs conducted by 
the Lyndon B. Johnson Space Center (formerly the Manned Spacecraft Center), the 
contractor, and the subcontractor. 

Following is a list of recommendations that should be considered for any future 
program similar to the Apollo Program. 

1. A strong effort should be made to establish baseline requirements before 

the start of the hardware design process. For example, requirement changes affecting 
hand controllers, humidity, in-flight maintenance, and many other parameters caused 
major redesign during the Apollo Program. 

2. Multiple-source procurement should be used for advanced design approaches. 
Generally, state-of-the-art design approaches should be adhered to; however, if this 
is not possible, alternate sources of procurement should be examined to prevent the 
development problems of a supplier from hindering the design of the total system. 

3. Firm specifications should be provided for crew personal-preference items. 

4. A technique should be used to assist in the rapid identification of single- 
point failures. The Apollo method required many engineers to search diagrams for 
problems, but this technique is not altogether successful for complex systems. 

5. An accurate low-g propellant-slosh model should be developed. The Apollo 
model produced some physically unreasonable results in simulations, and predictions 
based on this model were not confirmed by any of the flights. 

6. A better method of determining vehicle parameters such as body bending 
should be developed. The Apollo SCS underwent several redesigns because of updates 
in body-bending data. 

7. Criteria and methods to extend the duration of hardware reliability should be 
established. The long checkout times for complex space vehicles combined with the 
extended duration of some missions place a premium on the storage and long-life 
operation of the equipment. As an example, to obtain a realistic service life estimate, 
system qualification testing might be extended to the point of hardware wearout. 

8. Such devices as hand controllers should be designed as plug-in units so 
that cabling can be part of spacecraft wiring. Failure to follow this procedure on 
Apollo spacecraft resulted in the development of a completely new cable at a critical 
time in the program. Although the problem was resolved, extra care had to be taken 
for protecting the cables. 
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9. An in-house test capability setup that is maintained in a current configuration 
at all times should be provided for the investigation of interface, functional, perfor- 
mance usage, and operational problems. Use of such a capability setup would minimize 
surprises during the initial operational phases of a program and prevent use of a 
flight vehicle as a test bed in resolving complex problems. 

10. Serious consideration should be given to the use of solid-state switching in 
lieu of relays. If relays are used, superscreening tests should be established to ensure 
high reliability. 

11. Autopilots should be designed such that less sensitivity to spacecraft design 
variations (changes in vehicle bending mode frequencies and amplitudes caused by 
mass property changes) exists. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, May 30, 1974 
914-50-00-00-72 
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